Fastjson
Monthly
Remote code execution in Alibaba fastjson versions 1.2.68 through 1.2.83 allows remote, unauthenticated attackers to run arbitrary code by submitting crafted JSON to any endpoint that deserializes untrusted input. The vendor advisory emphasizes that exploitation works under fastjson's stock default configuration - AutoType does not need to be enabled and no external classpath gadget is required - which removes the mitigations most defenders historically relied on. No public exploit identified at time of analysis, but the CVSS 9.0 rating and scope change (S:C) mark this as a high-priority deserialization flaw.
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Remote code execution in Alibaba fastjson versions 1.2.68 through 1.2.83 allows remote, unauthenticated attackers to run arbitrary code by submitting crafted JSON to any endpoint that deserializes untrusted input. The vendor advisory emphasizes that exploitation works under fastjson's stock default configuration - AutoType does not need to be enabled and no external classpath gadget is required - which removes the mitigations most defenders historically relied on. No public exploit identified at time of analysis, but the CVSS 9.0 rating and scope change (S:C) mark this as a high-priority deserialization flaw.
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.